chore(deps): update dependency mongoose to v6 [security] by renovate[bot] · Pull Request #654 · CodeTanzania/majifix-service

renovate · 2023-05-28T11:18:31Z

ℹ️ Note

This PR body was truncated due to platform limits.

This PR contains the following updates:

Package	Change	Age	Confidence
mongoose (source)	`5.12.13` → `6.13.6`

automattic/mongoose vulnerable to Prototype pollution via Schema.path

CVE-2022-2564 / GHSA-f825-f98c-gj3g

More information

Details

Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment. Affected versions of this package are vulnerable to Prototype Pollution. The Schema.path() function is vulnerable to prototype pollution when setting the schema object. This vulnerability allows modification of the Object prototype and could be manipulated into a Denial of Service (DoS) attack.

Severity

CVSS Score: 7.0 / 10 (High)
Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Mongoose Prototype Pollution vulnerability

CVE-2023-3696 / GHSA-9m93-w8w6-76hh

More information

Details

Prototype Pollution in GitHub repository automattic/mongoose prior to 7.3.3, 6.11.3, and 5.13.20.

Severity

CVSS Score: 10.0 / 10 (Critical)
Vector String: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Mongoose Vulnerable to Prototype Pollution in Schema Object

CVE-2022-24304 / GHSA-h8hf-x3f4-xwgp

More information

Details

Description

Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment.

Affected versions of this package are vulnerable to Prototype Pollution. The Schema.path() function is vulnerable to prototype pollution when setting the schema object. This vulnerability allows modification of the Object prototype and could be manipulated into a Denial of Service (DoS) attack.

Proof of Concept

// poc.js
const mongoose = require('mongoose');
const schema = new mongoose.Schema();

malicious_payload = '__proto__.toString'

schema.path(malicious_payload, [String])

x = {}
console.log(x.toString()) // crashed (Denial of service (DoS) attack)

Impact

This vulnerability can be manipulated to exploit other types of attacks, such as Denial of service (DoS), Remote Code Execution, or Property Injection.

Severity

CVSS Score: 9.8 / 10 (Critical)
Vector String: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Mongoose search injection vulnerability

CVE-2025-23061 / GHSA-vg7j-7cwx-8wgw

More information

Details

Mongoose versions prior to 8.9.5, 7.8.4, and 6.13.6 are vulnerable to improper use of the $where operator. This vulnerability arises from the ability of the $where clause to execute arbitrary JavaScript code in MongoDB queries, potentially leading to code injection attacks and unauthorized access or manipulation of database data.

NOTE: this issue exists because of an incomplete fix for CVE-2024-53900.

Severity

CVSS Score: 9.0 / 10 (Critical)
Vector String: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Mongoose search injection vulnerability

CVE-2024-53900 / GHSA-m7xq-9374-9rvx

More information

Details

Mongoose versions prior to 8.8.3, 7.8.3, 6.13.5, and 5.13.23 are vulnerable to improper use of the $where operator. This vulnerability arises from the ability of the $where clause to execute arbitrary JavaScript code in MongoDB queries, potentially leading to code injection attacks and unauthorized access or manipulation of database data.

Severity

CVSS Score: 8.7 / 10 (High)
Vector String: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

References

This data is provided by the GitHub Advisory Database (CC-BY 4.0).

Release Notes

Automattic/mongoose (mongoose)

`v6.13.6`

Compare Source

===================

fix: disallow nested $where in populate match CVE-2025-23061

`v6.13.5`

Compare Source

===================

fix: disallow using $where in match

`v6.13.4`

Compare Source

===================

fix: save execution stack in query as string #15043 #15039
docs: clarify strictQuery default will flip-flop in "Migrating to 6.x" #14998 markstos

`v6.13.3`

Compare Source

===================

docs(migrating_to_6): document that Lodash _.isEmpty() with ObjectId() as a parameter returns true in Mongoose 6 #11152

`v6.13.2`

Compare Source

===================

fix(document): make set() respect merge option on deeply nested objects #14870 #14878

`v6.13.1`

Compare Source

===================

fix: remove empty $and, $or, $not that were made empty by scrict mode #14749 #13086 0x0a0d

`v6.13.0`

Compare Source

===================

feat(model): add throwOnValidationError option for opting into getting MongooseBulkWriteError if all valid operations succeed in bulkWrite() and insertMany() #14599 #14587 #14572 #13410

`v6.12.9`

Compare Source

===================

fix(cast): cast $comment to string in query filters #14590 #14576
types(model): allow passing strict type checking override to create() #14571 #14548

`v6.12.8`

Compare Source

===================

fix(document): handle virtuals that are stored as objects but getter returns string with toJSON #14468 #14446
fix(schematype): consistently set wasPopulated to object with value property rather than boolean #14418
docs(model): add extra note about lean option for insertMany() skipping casting #14415 #14376

`v6.12.7`

Compare Source

===================

perf(model): make insertMany() lean option skip hydrating Mongoose docs #14376 #14372
perf(document+schema): small optimizations to make init() faster #14383 #14113
fix(connection): don't modify passed options object to openUri() #14370 #13376 #13335
fix(ChangeStream): bubble up resumeTokenChanged changeStream event #14355 #14349 3150

`v6.12.6`

Compare Source

===================

fix(collection): correctly handle buffer timeouts with find() #14277
fix(document): allow calling push() with different $position arguments #14254

`v6.12.5`

Compare Source

===================

perf(schema): remove unnecessary lookahead in numeric subpath check
fix(document): allow setting nested path to null #14226
fix(document): avoid flattening dotted paths in mixed path underneath nested path #14198 #14178
fix: add ignoreAtomics option to isModified() for better backwards compatibility with Mongoose 5 #14213

`v6.12.4`

Compare Source

===================

fix: upgrade mongodb driver -> 4.17.2
fix(document): avoid treating nested projection as inclusive when applying defaults #14173 #14115
fix: account for null values when assigning isNew property #14172 #13883

`v6.12.3`

Compare Source

===================

fix(ChangeStream): correctly handle hydrate option when using change stream as stream instead of iterator #14052
fix(schema): fix dangling reference to virtual in tree after removeVirtual() #14019 #13085
fix(document): avoid unmarking modified on nested path if no initial value stored and already modified #14053 #14024
fix(document): consistently avoid marking subpaths of nested paths as modified #14053 #14022

`v6.12.2`

Compare Source

===================

fix: add fullPath to ValidatorProps #13995 Freezystem

`v6.12.1`

Compare Source

===================

fix(mongoose): correctly handle global applyPluginsToChildSchemas option #13945 #13887 hasezoey
fix: Document.prototype.isModified support for a string of keys as first parameter #13940 #13674 k-chop

`v6.12.0`

Compare Source

===================

feat: use mongodb driver v4.17.1
fix(model): make Model.bulkWrite() with empty array and ordered false not throw an error #13664
fix(document): correctly handle inclusive/exclusive projections when applying subdocument defaults #13763 #13720

`v6.11.6`

Compare Source

===================

fix(model): avoid hanging on empty bulkWrite() with ordered: false #13701 #13684 JavaScriptBach
types: augment bson.ObjectId instead of adding on own type #13515 #12537 hasezoey

`v6.11.5`

Compare Source

===================

fix(schema): make Schema.prototype.clone() avoid creating different copies of subdocuments and single nested paths underneath single nested paths #13671 #13626
fix: custom debug function not processing all args #13418

`v6.11.4`

Compare Source

===================

perf: speed up mapOfSubdocs benchmark by 4x by avoiding unnecessary O(n^2) loop in getPathsToValidate() #13614

`v6.11.3`

Compare Source

===================

fix: avoid prototype pollution on init
fix(schema): correctly handle uuids with populate() #13317 #13595

`v6.11.2`

Compare Source

===================

fix(cursor): allow find middleware to modify query cursor options #13476 #13453 #13435

`v6.11.1`

Compare Source

===================

fix(query): apply schema-level paths before calculating projection for findOneAndUpdate() #13348 #13340
fix: add SUPPRESS_JEST_WARNINGS environment variable to hide jest warnings #13384 #13373
types(model): allow overwriting expected param type for bulkWrite() #13292 hasezoey

`v6.11.0`

Compare Source

===================

feat: upgrade to mongodb 4.16.0 for Deno+Atlas connection fix #13337 #13075
perf: speed up creating maps of subdocuments #13280 #13191 #13271
fix(query): set ObjectParameterError if calling findOneAndX() with filter as non-object #13338
fix(document): merge Document $inc calls instead of overwriting #13322
fix(update): handle casting doubly nested arrays with $pullAll #13285
docs: backport documentation versioning changes to 6.x #13253 #13190 hasezoey

`v6.10.5`

Compare Source

===================

perf(document): avoid unnecessary loops, conditionals, string manipulation on Document.prototype.get() for 10x speedup on top-level properties #12953
fix(model): execute valid write operations if calling bulkWrite() with ordered: false #13218 #13176
fix(array): pass-through all parameters #13202 #13201 hasezoey
fix: improve error message when sorting by empty string #13249 #10182
docs: add version support and check version docs #13251 #13193

`v6.10.4`

Compare Source

===================

fix(document): apply setters on resulting value when calling Document.prototype.$inc() #13178 #13158
fix(model): add results property to unordered insertMany() to make it easy to identify exactly which documents were inserted #13163 #12791
docs(guide+schematypes): add UUID to schematypes guide #13184

`v6.10.3`

Compare Source

===================

fix(connection): add stub implementation of doClose to base connection class #13157
fix(types): add cursor.eachAsync index parameter #13162 #13153 hasezoey
docs: fix 6.x docs sidebar links #13147 #13144 hasezoey
docs(validation): clarify that validation runs as first pre(save) middleware #13062

`v6.10.2`

Compare Source

===================

fix(document): avoid setting array default if document array projected out by sibling projection #13135 #13043 #13003
fix(documentarray): set correct document array path if making map of document arrays #13133
fix: undo accidental change to engines in package.json #13124 lorand-horvath
docs: quick improvement to Model.init() docs #13054

`v6.10.1`

Compare Source

===================

fix: avoid removing empty query filters in $and and $or #13086 #12898
fix(schematype): fixed validation for required UUID field #13018 lpizzinidev
fix(types): add missing Paths generic param to Model.populate() #13070
docs(migrating_to_6): added info about removal of reconnectTries and reconnectInterval options #13083 lpizzinidev
docs: fix code in headers for migrating_to_5 #13077 hasezoey
docs: backport misc documentation changes into 6.x #13091 hasezoey

`v6.10.0`

Compare Source

===================

feat: upgrade to mongodb driver 4.14.0 #13036
feat: added Schema.prototype.omit() function #12939 #12931 lpizzinidev
feat(index): added createInitialConnection option to Mongoose constructor #13021 #12965 lpizzinidev

`v6.9.3`

Compare Source

==================

fix(connection): delay calculating autoCreate and autoIndex until after initial connection established #13007 #12940 lpizzinidev
fix(discriminator): allows update doc with discriminatorKey #13056 #13055 abarriel
fix(query): avoid sending unnecessary empty projection to MongoDB server #13059 #13050
fix(model): avoid sending null session option with document operations #13053 #13052 lpizzinidev
fix(types): use MergeTypes for type overrides in HydratedDocument #13066 #13040
docs(middleware): list validate as a potential query middleware #13057 #12680
docs(getters-setters): explain that getters do not run by default on toJSON() #13058 #13049
docs: refactor docs generation scripts #13044 hasezoey

`v6.9.2`

Compare Source

==================

fix(model): fixed post('save') callback parameter #13030 #13026 lpizzinidev
fix(UUID): added null check to prevent error on binaryToString conversion #13034 #13032 #13029 lpizzinidev Freezystem
fix(query): revert breaking changes introduced by #12797 #12999 lpizzinidev
fix(document): make array $shift() use $pop instead of overwriting array #13004
docs: update & remove old links #13019 hasezoey
docs(middleware): describe how to access model from document middleware #13031 AxeOfMen
docs: update broken & outdated links #13001 hasezoey
chore: change deno tests to also use MMS #12918 hasezoey

`v6.9.1`

Compare Source

==================

fix(document): isModified should not be triggered when setting a nested boolean to the same value as previously #12994 lpizzinidev
fix(document): save newly set defaults underneath single nested subdocuments #13002 #12905
fix(update): handle custom discriminator model name when casting update #12947 wassil
fix(connection): handles unique autoincrement ID for connections #12990 lpizzinidev
fix(types): fix type of options of Model.aggregate #12933 ghost91-
fix(types): fix "near" aggregation operator input type #12954 Jokero
fix(types): add missing Top operator to AccumulatorOperator type declaration #12952 lpizzinidev
docs(transactions): added example for Connection.transaction() method #12943 #12934 lpizzinidev
docs(populate): fix out of date comment referencing onModel property #13000
docs(transactions): fix typo in transactions.md #12995 Parth86

`v6.9.0`

Compare Source

==================

feat(schema): add removeVirtual(path) function to schema #12920 IslandRhythms
fix(cast): remove empty $or conditions after strict applied #12898 0x0a0d
docs: fixed typo #12946 Gbengstar

`v6.8.4`

Compare Source

==================

fix(collection): handle creating model when connection disconnected with bufferCommands = false #12889
fix(populate): merge instead of overwrite when match is on _id #12891
fix: add guard to stop loadClass copying Document if Document is used as base of loaded class (same hack as implemented for Model already) #12820 sgpinkus
fix(types): correctly infer types on document arrays #12884 #12882 JavaScriptBach
fix(types): added omit for ArraySubdocument type in LeanType declaration #12903 piyushk96
fix(types): add returnDocument type safety #12906 AbdelrahmanHafez
docs(typescript): add notes about virtual context to Mongoose 6 migration and TypeScript virtuals docs #12912 #12806
docs(schematypes): removed dead link and fixed formatting #12897 #12885 lpizzinidev
docs: fix link to lean api #12910 manniL
docs: list all possible strings for schema.pre in one place #12868
docs: add list of known incompatible npm packages #12892 IslandRhythms

`v6.8.3`

Compare Source

==================

perf: improve performance of assignRawDocsToIdStructure for faster populate on large docs #12867 Uzlopak
fix(model): ensure consistent ordering of validation errors in insertMany() with ordered: false and rawResult: true #12866
fix: avoid passing final callback to pre hook, because calling the callback can mess up hook execution #12836
fix(types): avoid inferring timestamps if methods, virtuals, or statics set #12871
fix(types): correctly infer string enums on const arrays #12870 JavaScriptBach
fix(types): allow virtuals to be invoked in the definition of other virtuals #12874 sffc
fix(types): add type def for Aggregate#model without arguments #12864 hasezoey
docs(discriminators): add section about changing discriminator key #12861
docs(typescript): explain that virtuals inferred from schema only show up on Model, not raw document type #12860 #12684

`v6.8.2`

Compare Source

==================

fix(schema): propagate strictQuery to implicitly created schemas for embedded discriminators #12827 #12796
fix(model): respect discriminators with Model.validate() #12824 #12621
fix(query): fix unexpected validation error when doing findOneAndReplace() with a nullish value #12826 #12821
fix(discriminator): apply built-in plugins to discriminator schema even if mergeHooks and mergePlugins are both false #12833 #12696
fix(types): add option "overwriteModels" as a schema option #12817 #12816 hasezoey
fix(types): add property "defaultOptions" #12818 hasezoey
docs: make search bar respect documentation version, so you can search 5.x docs #12548
docs(typescript): make note about recommending strict mode when using auto typed schemas #12825 #12420
docs: add section on sorting to query docs #12588 IslandRhythms
test(query.test): add write-concern option #12829 hasezoey

`v6.8.1`

Compare Source

==================

fix(query): avoid throwing circular dependency error if same object is used in multiple properties #12774 orgads
fix(map): return value from super.delete() #12777 danbrud
fix(populate): handle virtual populate underneath document array with justOne=true and sort set where 1 element has only 1 result #12815 #12730
fix(update): handle embedded discriminators when casting array filters #12802 #12565
fix(populate): avoid calling transform if there's no populate results and using lean #12804 #12739
fix(model): prevent index creation on syncIndexes if not necessary #12785 #12250 lpizzinidev
fix(types): correctly infer this when using pre('updateOne') with { document: true, query: false } #12778
fix(types): make InferSchemaType: consider { required: boolean } required if it isn't explicitly false #12784 JavaScriptBach
docs: replace many occurrences of "localhost" with "127.0.0.1" #12811 #12741 hasezoey SadiqOnGithub
docs(mongoose): Added missing options to set #12810 lpizzinidev
docs: add info on $locals parameters to getters/setters tutorial #12814 #12550 IslandRhythms
docs: make Document.prototype.$clone() public #12803
docs(query): updated explanation for slice #12776 #12474 lpizzinidev
docs(middleware): fix broken links #12787 lpizzinidev
docs(queries): fixed broken links #12790 lpizzinidev

`v6.8.0`

Compare Source

==================

feat: add alpha support for Deno #12397 #9056
feat: add deprecation warning for default strictQuery #12666
feat: upgrade to MongoDB driver 4.12.1
feat(schema): add doc as second params to validation message function #12564 #12651 IslandRhythms
feat(document): add $clone method #12549 #11849 lpizzinidev
feat(populate): allow overriding localField and foreignField for virtual populate #12657 #6963 IslandRhythms
feat(schema+types): add { errorHandler: true } option to Schema post() for better TypeScript support #12723 #12583
feat(debug): allow setting debug on a per-connection basis #12704 #12700 lpizzinidev
feat: add rewind function to QueryCursor #12710 passabilities
feat(types): infer timestamps option from schema #12731 #12069
docs: change links to not link to api.html anymore #12644 hasezoey

`v6.7.5`

Compare Source

==================

fix(schema): copy indexes when calling add() with schema instance #12737 #12654
fix(query): handle deselecting _id when another field has schema-level select: false #12736 #12670
fix(types): support using UpdateQuery in bulkWrite() #12742 #12595
docs(middleware): added note about execution policy on subdocuments #12735 #12694 lpizzinidev
docs(validation): clarify context for update validators in validation docs #12738 #12655 IslandRhythms

[`v6.7.4`](http

✂ Note

PR body was truncated to here.

Configuration

📅 Schedule: (UTC)

Branch creation
- ""
Automerge
- At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about these updates again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate · 2023-07-19T11:23:52Z

⚠ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

any of the package files in this branch needs updating, or
the branch becomes conflicted, or
you click the rebase/retry checkbox if found above, or
you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: package-lock.json

npm WARN ERESOLVE overriding peer dependency
npm WARN While resolving: doxdox-parser-dox@2.0.0
npm WARN Found: doxdox@3.0.0
npm WARN node_modules/doxdox
npm WARN   dev doxdox@"3.0.0" from the root project
npm WARN 
npm WARN Could not resolve dependency:
npm WARN peer doxdox@"~2.0.3" from doxdox-parser-dox@2.0.0
npm WARN node_modules/doxdox-parser-dox
npm WARN   doxdox-parser-dox@"~2.0.0" from doxdox@3.0.0
npm WARN   node_modules/doxdox
npm WARN 
npm WARN Conflicting peer dependency: doxdox@2.0.3
npm WARN node_modules/doxdox
npm WARN   peer doxdox@"~2.0.3" from doxdox-parser-dox@2.0.0
npm WARN   node_modules/doxdox-parser-dox
npm WARN     doxdox-parser-dox@"~2.0.0" from doxdox@3.0.0
npm WARN     node_modules/doxdox
npm WARN ERESOLVE overriding peer dependency
npm WARN While resolving: doxdox-plugin-bootstrap@2.0.0
npm WARN Found: doxdox@3.0.0
npm WARN node_modules/doxdox
npm WARN   dev doxdox@"3.0.0" from the root project
npm WARN 
npm WARN Could not resolve dependency:
npm WARN peer doxdox@"~2.0.3" from doxdox-plugin-bootstrap@2.0.0
npm WARN node_modules/doxdox-plugin-bootstrap
npm WARN   doxdox-plugin-bootstrap@"~2.0.0" from doxdox@3.0.0
npm WARN   node_modules/doxdox
npm WARN 
npm WARN Conflicting peer dependency: doxdox@2.0.3
npm WARN node_modules/doxdox
npm WARN   peer doxdox@"~2.0.3" from doxdox-plugin-bootstrap@2.0.0
npm WARN   node_modules/doxdox-plugin-bootstrap
npm WARN     doxdox-plugin-bootstrap@"~2.0.0" from doxdox@3.0.0
npm WARN     node_modules/doxdox
npm WARN ERESOLVE overriding peer dependency
npm WARN While resolving: doxdox-plugin-handlebars@2.0.0
npm WARN Found: doxdox@3.0.0
npm WARN node_modules/doxdox
npm WARN   dev doxdox@"3.0.0" from the root project
npm WARN 
npm WARN Could not resolve dependency:
npm WARN peer doxdox@"~2.0.3" from doxdox-plugin-handlebars@2.0.0
npm WARN node_modules/doxdox-plugin-handlebars
npm WARN   doxdox-plugin-handlebars@"~2.0.0" from doxdox@3.0.0
npm WARN   node_modules/doxdox
npm WARN 
npm WARN Conflicting peer dependency: doxdox@2.0.3
npm WARN node_modules/doxdox
npm WARN   peer doxdox@"~2.0.3" from doxdox-plugin-handlebars@2.0.0
npm WARN   node_modules/doxdox-plugin-handlebars
npm WARN     doxdox-plugin-handlebars@"~2.0.0" from doxdox@3.0.0
npm WARN     node_modules/doxdox
npm WARN ERESOLVE overriding peer dependency
npm WARN While resolving: doxdox-plugin-markdown@2.0.0
npm WARN Found: doxdox@3.0.0
npm WARN node_modules/doxdox
npm WARN   dev doxdox@"3.0.0" from the root project
npm WARN 
npm WARN Could not resolve dependency:
npm WARN peer doxdox@"~2.0.3" from doxdox-plugin-markdown@2.0.0
npm WARN node_modules/doxdox-plugin-markdown
npm WARN   doxdox-plugin-markdown@"~2.0.0" from doxdox@3.0.0
npm WARN   node_modules/doxdox
npm WARN 
npm WARN Conflicting peer dependency: doxdox@2.0.3
npm WARN node_modules/doxdox
npm WARN   peer doxdox@"~2.0.3" from doxdox-plugin-markdown@2.0.0
npm WARN   node_modules/doxdox-plugin-markdown
npm WARN     doxdox-plugin-markdown@"~2.0.0" from doxdox@3.0.0
npm WARN     node_modules/doxdox
npm ERR! code ERESOLVE
npm ERR! ERESOLVE could not resolve
npm ERR! 
npm ERR! While resolving: eslint-config-prettier@7.2.0
npm ERR! Found: eslint@6.8.0
npm ERR! node_modules/eslint
npm ERR!   peer eslint@"^5.16.0 || ^6.8.0 || ^7.2.0" from eslint-config-airbnb-base@14.2.1
npm ERR!   node_modules/eslint-config-airbnb-base
npm ERR!     dev eslint-config-airbnb-base@"14.2.1" from the root project
npm ERR!   peer eslint@"^2 || ^3 || ^4 || ^5 || ^6 || ^7.2.0" from eslint-plugin-import@2.23.4
npm ERR!   node_modules/eslint-plugin-import
npm ERR!     peer eslint-plugin-import@"^2.22.1" from eslint-config-airbnb-base@14.2.1
npm ERR!     node_modules/eslint-config-airbnb-base
npm ERR!       dev eslint-config-airbnb-base@"14.2.1" from the root project
npm ERR!     dev eslint-plugin-import@"2.23.4" from the root project
npm ERR!   4 more (eslint-plugin-jsdoc, eslint-plugin-mocha, ...)
npm ERR! 
npm ERR! Could not resolve dependency:
npm ERR! peer eslint@">=7.0.0" from eslint-config-prettier@7.2.0
npm ERR! node_modules/eslint-config-prettier
npm ERR!   dev eslint-config-prettier@"7.2.0" from the root project
npm ERR! 
npm ERR! Conflicting peer dependency: eslint@9.1.1
npm ERR! node_modules/eslint
npm ERR!   peer eslint@">=7.0.0" from eslint-config-prettier@7.2.0
npm ERR!   node_modules/eslint-config-prettier
npm ERR!     dev eslint-config-prettier@"7.2.0" from the root project
npm ERR! 
npm ERR! Fix the upstream dependency conflict, or retry
npm ERR! this command with --force or --legacy-peer-deps
npm ERR! to accept an incorrect (and potentially broken) dependency resolution.
npm ERR! 
npm ERR! 
npm ERR! For a full report see:
npm ERR! /tmp/renovate/cache/others/npm/_logs/2024-04-25T09_08_27_571Z-eresolve-report.txt

npm ERR! A complete log of this run can be found in: /tmp/renovate/cache/others/npm/_logs/2024-04-25T09_08_27_571Z-debug-0.log

renovate · 2024-06-04T10:27:24Z

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

any of the package files in this branch needs updating, or
the branch becomes conflicted, or
you click the rebase/retry checkbox if found above, or
you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: package-lock.json

npm warn Unknown env config "store". This will stop working in the next major version of npm. See `npm help npmrc` for supported config options.
npm warn ERESOLVE overriding peer dependency
npm warn While resolving: doxdox-parser-dox@2.0.0
npm warn Found: doxdox@3.0.0
npm warn node_modules/doxdox
npm warn   dev doxdox@"3.0.0" from the root project
npm warn
npm warn Could not resolve dependency:
npm warn peer doxdox@"~2.0.3" from doxdox-parser-dox@2.0.0
npm warn node_modules/doxdox-parser-dox
npm warn   doxdox-parser-dox@"~2.0.0" from doxdox@3.0.0
npm warn   node_modules/doxdox
npm warn
npm warn Conflicting peer dependency: doxdox@2.0.3
npm warn node_modules/doxdox
npm warn   peer doxdox@"~2.0.3" from doxdox-parser-dox@2.0.0
npm warn   node_modules/doxdox-parser-dox
npm warn     doxdox-parser-dox@"~2.0.0" from doxdox@3.0.0
npm warn     node_modules/doxdox
npm warn ERESOLVE overriding peer dependency
npm warn While resolving: doxdox-plugin-bootstrap@2.0.0
npm warn Found: doxdox@3.0.0
npm warn node_modules/doxdox
npm warn   dev doxdox@"3.0.0" from the root project
npm warn
npm warn Could not resolve dependency:
npm warn peer doxdox@"~2.0.3" from doxdox-plugin-bootstrap@2.0.0
npm warn node_modules/doxdox-plugin-bootstrap
npm warn   doxdox-plugin-bootstrap@"~2.0.0" from doxdox@3.0.0
npm warn   node_modules/doxdox
npm warn
npm warn Conflicting peer dependency: doxdox@2.0.3
npm warn node_modules/doxdox
npm warn   peer doxdox@"~2.0.3" from doxdox-plugin-bootstrap@2.0.0
npm warn   node_modules/doxdox-plugin-bootstrap
npm warn     doxdox-plugin-bootstrap@"~2.0.0" from doxdox@3.0.0
npm warn     node_modules/doxdox
npm warn ERESOLVE overriding peer dependency
npm warn While resolving: doxdox-plugin-handlebars@2.0.0
npm warn Found: doxdox@3.0.0
npm warn node_modules/doxdox
npm warn   dev doxdox@"3.0.0" from the root project
npm warn
npm warn Could not resolve dependency:
npm warn peer doxdox@"~2.0.3" from doxdox-plugin-handlebars@2.0.0
npm warn node_modules/doxdox-plugin-handlebars
npm warn   doxdox-plugin-handlebars@"~2.0.0" from doxdox@3.0.0
npm warn   node_modules/doxdox
npm warn
npm warn Conflicting peer dependency: doxdox@2.0.3
npm warn node_modules/doxdox
npm warn   peer doxdox@"~2.0.3" from doxdox-plugin-handlebars@2.0.0
npm warn   node_modules/doxdox-plugin-handlebars
npm warn     doxdox-plugin-handlebars@"~2.0.0" from doxdox@3.0.0
npm warn     node_modules/doxdox
npm warn ERESOLVE overriding peer dependency
npm warn While resolving: doxdox-plugin-markdown@2.0.0
npm warn Found: doxdox@3.0.0
npm warn node_modules/doxdox
npm warn   dev doxdox@"3.0.0" from the root project
npm warn
npm warn Could not resolve dependency:
npm warn peer doxdox@"~2.0.3" from doxdox-plugin-markdown@2.0.0
npm warn node_modules/doxdox-plugin-markdown
npm warn   doxdox-plugin-markdown@"~2.0.0" from doxdox@3.0.0
npm warn   node_modules/doxdox
npm warn
npm warn Conflicting peer dependency: doxdox@2.0.3
npm warn node_modules/doxdox
npm warn   peer doxdox@"~2.0.3" from doxdox-plugin-markdown@2.0.0
npm warn   node_modules/doxdox-plugin-markdown
npm warn     doxdox-plugin-markdown@"~2.0.0" from doxdox@3.0.0
npm warn     node_modules/doxdox
npm error code ERESOLVE
npm error ERESOLVE could not resolve
npm error
npm error While resolving: eslint-config-prettier@7.2.0
npm error Found: eslint@6.8.0
npm error node_modules/eslint
npm error   peer eslint@"^5.16.0 || ^6.8.0 || ^7.2.0" from eslint-config-airbnb-base@14.2.1
npm error   node_modules/eslint-config-airbnb-base
npm error     dev eslint-config-airbnb-base@"14.2.1" from the root project
npm error   peer eslint@"^2 || ^3 || ^4 || ^5 || ^6 || ^7.2.0" from eslint-plugin-import@2.23.4
npm error   node_modules/eslint-plugin-import
npm error     peer eslint-plugin-import@"^2.22.1" from eslint-config-airbnb-base@14.2.1
npm error     node_modules/eslint-config-airbnb-base
npm error       dev eslint-config-airbnb-base@"14.2.1" from the root project
npm error     dev eslint-plugin-import@"2.23.4" from the root project
npm error   4 more (eslint-plugin-jsdoc, eslint-plugin-mocha, ...)
npm error
npm error Could not resolve dependency:
npm error peer eslint@">=7.0.0" from eslint-config-prettier@7.2.0
npm error node_modules/eslint-config-prettier
npm error   dev eslint-config-prettier@"7.2.0" from the root project
npm error
npm error Conflicting peer dependency: eslint@10.2.1
npm error node_modules/eslint
npm error   peer eslint@">=7.0.0" from eslint-config-prettier@7.2.0
npm error   node_modules/eslint-config-prettier
npm error     dev eslint-config-prettier@"7.2.0" from the root project
npm error
npm error Fix the upstream dependency conflict, or retry this command with --force or --legacy-peer-deps to accept an incorrect (and potentially broken) dependency resolution.
npm error
npm error
npm error For a full report see:
npm error /runner/cache/others/npm/_logs/2026-04-29T19_52_35_431Z-eresolve-report.txt
npm error A complete log of this run can be found in: /runner/cache/others/npm/_logs/2026-04-29T19_52_35_431Z-debug-0.log

renovate Bot force-pushed the renovate/npm-mongoose-vulnerability branch from 581f43e to 04dcc3a Compare June 4, 2023 10:21

renovate Bot force-pushed the renovate/npm-mongoose-vulnerability branch 3 times, most recently from 1d6c923 to db0b44e Compare June 19, 2023 06:59

renovate Bot force-pushed the renovate/npm-mongoose-vulnerability branch from db0b44e to 9cbfe3f Compare June 29, 2023 09:12

renovate Bot force-pushed the renovate/npm-mongoose-vulnerability branch 2 times, most recently from e4abe3d to a5ae4b5 Compare July 9, 2023 11:06

renovate Bot force-pushed the renovate/npm-mongoose-vulnerability branch from a5ae4b5 to 3bd6186 Compare July 16, 2023 17:44

renovate Bot force-pushed the renovate/npm-mongoose-vulnerability branch from 3bd6186 to 286b278 Compare August 6, 2024 08:59

renovate Bot changed the title ~~chore(deps): update dependency mongoose to v5.13.15 [security]~~ chore(deps): update dependency mongoose to v5.13.20 [security] Aug 6, 2024

renovate Bot force-pushed the renovate/npm-mongoose-vulnerability branch from 286b278 to 81f5549 Compare December 3, 2024 03:57

renovate Bot changed the title ~~chore(deps): update dependency mongoose to v5.13.20 [security]~~ chore(deps): update dependency mongoose to v8 [security] Dec 3, 2024

renovate Bot force-pushed the renovate/npm-mongoose-vulnerability branch from 81f5549 to 780df37 Compare December 4, 2024 18:46

renovate Bot changed the title ~~chore(deps): update dependency mongoose to v8 [security]~~ chore(deps): update dependency mongoose to v5.13.20 [security] Dec 4, 2024

renovate Bot force-pushed the renovate/npm-mongoose-vulnerability branch from 780df37 to 3a71f98 Compare December 4, 2024 21:51

renovate Bot changed the title ~~chore(deps): update dependency mongoose to v5.13.20 [security]~~ chore(deps): update dependency mongoose to v6 [security] Dec 4, 2024

renovate Bot force-pushed the renovate/npm-mongoose-vulnerability branch from 3a71f98 to dfa5e8f Compare January 16, 2025 21:27

renovate Bot changed the title ~~chore(deps): update dependency mongoose to v6 [security]~~ chore(deps): update dependency mongoose to v8 [security] Jan 16, 2025

renovate Bot force-pushed the renovate/npm-mongoose-vulnerability branch from dfa5e8f to f4783ab Compare January 17, 2025 21:01

renovate Bot changed the title ~~chore(deps): update dependency mongoose to v8 [security]~~ chore(deps): update dependency mongoose to v6 [security] Jan 17, 2025

renovate Bot force-pushed the renovate/npm-mongoose-vulnerability branch from f4783ab to 0547a20 Compare January 18, 2025 01:04

renovate Bot force-pushed the renovate/npm-mongoose-vulnerability branch 2 times, most recently from e11e2de to 280599d Compare February 5, 2026 02:07

renovate Bot changed the title ~~chore(deps): update dependency mongoose to v6 [security]~~ chore(deps): update dependency mongoose to v5.13.23 [security] Feb 5, 2026

renovate Bot changed the title ~~chore(deps): update dependency mongoose to v5.13.23 [security]~~ chore(deps): update dependency mongoose to v5.13.23 [security] - autoclosed Mar 27, 2026

renovate Bot closed this Mar 27, 2026

renovate Bot deleted the renovate/npm-mongoose-vulnerability branch March 27, 2026 02:11

renovate Bot changed the title ~~chore(deps): update dependency mongoose to v5.13.23 [security] - autoclosed~~ chore(deps): update dependency mongoose to v5.13.23 [security] Mar 30, 2026

renovate Bot reopened this Mar 30, 2026

renovate Bot force-pushed the renovate/npm-mongoose-vulnerability branch 2 times, most recently from 280599d to c7f48ee Compare March 30, 2026 21:27

renovate Bot force-pushed the renovate/npm-mongoose-vulnerability branch from c7f48ee to 6715cd8 Compare April 15, 2026 09:35

renovate Bot changed the title ~~chore(deps): update dependency mongoose to v5.13.23 [security]~~ chore(deps): update dependency mongoose to v6 [security] Apr 15, 2026

renovate Bot changed the title ~~chore(deps): update dependency mongoose to v6 [security]~~ chore(deps): update dependency mongoose to v6 [security] - autoclosed Apr 27, 2026

renovate Bot closed this Apr 27, 2026

chore(deps): update dependency mongoose to v6 [security]

399d503

renovate Bot changed the title ~~chore(deps): update dependency mongoose to v6 [security] - autoclosed~~ chore(deps): update dependency mongoose to v6 [security] Apr 27, 2026

renovate Bot reopened this Apr 27, 2026

renovate Bot force-pushed the renovate/npm-mongoose-vulnerability branch 2 times, most recently from 6715cd8 to 399d503 Compare April 27, 2026 23:44

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

chore(deps): update dependency mongoose to v6 [security]#654

chore(deps): update dependency mongoose to v6 [security]#654
renovate[bot] wants to merge 1 commit intodevelopfrom
renovate/npm-mongoose-vulnerability

renovate Bot commented May 28, 2023 •

edited

Loading

Uh oh!

renovate Bot commented Jul 19, 2023 •

edited

Loading

Uh oh!

renovate Bot commented Jun 4, 2024 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate Bot commented May 28, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

automattic/mongoose vulnerable to Prototype pollution via Schema.path

Details

Severity

References

Mongoose Prototype Pollution vulnerability

Details

Severity

References

Mongoose Vulnerable to Prototype Pollution in Schema Object

Details

Description

Proof of Concept

Impact

Severity

References

Mongoose search injection vulnerability

Details

Severity

References

Mongoose search injection vulnerability

Details

Severity

References

Release Notes

[v6.7.4](http

Configuration

Uh oh!

renovate Bot commented Jul 19, 2023 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠ Artifact update problem

File name: package-lock.json

Uh oh!

renovate Bot commented Jun 4, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ Artifact update problem

File name: package-lock.json

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate Bot commented May 28, 2023 •

edited

Loading

[`v6.7.4`](http

renovate Bot commented Jul 19, 2023 •

edited

Loading

renovate Bot commented Jun 4, 2024 •

edited

Loading